Soulprint

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:29 PM UTC
• Version: 1.0.25

Overview

The skill has a coherent identity-verification purpose, but it asks users to run unpinned npm commands while processing sensitive identity and biometric data.

Review the package provenance before installing. Prefer pinned exact versions or a lockfile, run identity verification only on a trusted machine, isolate wallets and API tokens from the process, and confirm what data is stored, deleted, or sent over the network before using the cédula or face-match workflow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:79

Finding

Unpinned Third-Party npm Packages Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 79–80; additional occurrences at lines 86, 174, and 177
Vulnerability Type: Supply-chain risk caused by unpinned remote package execution
Risk Level: Medium

Vulnerable Code

bash

npx soulprint install-deps   # OCR + face recognition — only once
npx soulprint verify-me      # all local, nothing uploaded

Additional unpinned commands include:

bash

npx soulprint-network

bash

npx mcp-colombia-hub
npx soulprint verify-me

Technical Analysis

The documented commands use npx without exact package versions or verified integrity hashes. When the requested package is not already available locally, npx can retrieve current package content from the configured npm registry and execute its CLI code with the user's permissions.

The install-deps subcommand adds further risk because its behavior is controlled by remotely obtained package code and may install additional OCR or face-recognition components. The project contains no lockfile, checksums, package provenance information, or source code through which these installation operations can be independently reviewed.

The documentation's statements that processing is local and that nothing is uploaded cannot be verified from the single file included in the audited project.

Attack Path

1. An attacker compromises the npm account, release pipeline, registry entry, or dependency chain of one of the named packages.
2. The attacker publishes a malicious release under the same package name or compromises a transitive dependency selected by the current release.
3. A user follows the Skill documentation and runs an unversioned npx command.
4. npx retrieves the current package content rather than a previously audited, immutable version.
5. Package lifecycle scripts or CLI entry points execute attacker-controlled code.
6. The payload operates with the privileges of the ...[truncated 784 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every npm invocation to a reviewed exact version, such as npx --yes package-name@x.y.z, rather than relying on the registry's current release.
2. Commit a lockfile for supported installation workflows and use deterministic installation commands such as npm ci.
3. Publish expected package integrity hashes and verify downloaded artifacts before execution.
4. Document the package publisher, repository, release signing process, and provenance attestations.
5. Replace the opaque install-deps operation with a documented dependency list and explicit installation steps.
6. Review and constrain npm lifecycle scripts. Use --ignore-scripts where compatible, then invoke only audited setup operations explicitly.
7. Run identity-processing components in a sandbox with restricted filesystem, network, environment-variable, and wallet access.
8. Clearly document whether each command requires network access and what data may leave the local machine.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Inconsistent and Mutable Package Identity Creates Supply-Chain Ambiguity

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12–19, 29, and 148–154
Vulnerability Type: Ambiguous package selection and mutable dependency versions
Risk Level: Medium

Vulnerable Code

yaml

"install":
  [
    {
      "id": "node",
      "kind": "node",
      "package": "soulprint",
      "bins": ["soulprint"],
      "label": "Install Soulprint CLI (npm)",
    },
  ],

The principal npm link identifies a different package:

markdown

**npm:** https://www.npmjs.com/package/soulprint-network

The package table also mixes one versioned package with several mutable latest references:

markdown

| `soulprint-network` | 0.6.4 | Validator node (HTTP + blockchain clients) |
| `soulprint-mcp` | latest | MCP middleware |
| `soulprint-express` | latest | Express/Fastify middleware |
| `soulprint-core` | latest | DID, tokens, protocol constants |
| `soulprint-zkp` | latest | ZK proofs (Circom + snarkjs) |
| `soulprint-verify` | latest | OCR + face match |
| `soulprint` | latest | CLI |

Technical Analysis

The installation metadata directs the framework to install soulprint, while the document's primary npm link points to soulprint-network. The package table presents these as separate packages and identifies most related components only as latest.

This inconsistency prevents users and automated installers from reliably determining which package and release constitute the reviewed implementation. It also makes a source review of one package insufficient to establish the behavior of another package selected by the metadata or commands.

Mutable latest references can silently change the effective code after this Skill has been audited. Although the reviewed file does not prove that any named package is malicious, the ambiguity creates an avoidable supply-chain substitution risk.

Attack Path

1. A user reviews the repository or npm page link ...[truncated 1204 chars]

Remediation

View remediation

Remediation Suggestions

1. Define one canonical package for each function and use the same exact package name in metadata, links, examples, and package tables.
2. Prefer scoped package names controlled by a verified organization to reduce naming and ownership ambiguity.
3. Replace every latest reference with a reviewed exact version.
4. Link each package directly to its authoritative npm page and source repository.
5. Document the expected npm publisher and package ownership for every component.
6. Provide integrity hashes, signed releases, and npm provenance attestations.
7. Add automated validation that rejects mismatches between installation metadata, documented commands, package names, and documented versions.
8. Require a new security review whenever a pinned package version or integrity value changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill describes identity verification steps involving OCR and face recognition but does not prominently warn that these operations process highly sensitive identity and biometric data. In practice, this omission can cause users to run the workflow without understanding privacy, retention, device security, or local-environment risks, which is especially dangerous given the document's emphasis on cédula verification and face matching.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill instructs users to execute npx soulprint without pinning an exact version, which allows retrieval of whatever package version is current at execution time. In a security-sensitive identity verification workflow handling document and biometric data, a compromised maintainer account, malicious update, or dependency hijack could result in arbitrary code execution and theft of highly sensitive local data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The unpinned npx soulprint verify-me command fetches and runs the latest published package code at runtime. Because this command is explicitly used for local identity verification and may process cédula, OCR, and face-match data, any malicious package update would have direct access to exceptionally sensitive personal data and the host environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill recommends npx soulprint-network without a fixed version for running validator infrastructure. This exposes operators to remote code execution through package substitution or malicious updates, and in this context could compromise validator keys, admin tokens, network trust decisions, and any connected blockchain or API infrastructure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The example npx mcp-colombia-hub launches an unpinned package that implicitly integrates with Soulprint identity tooling. While somewhat indirect, it still creates a supply-chain execution path where a malicious release could run arbitrary code or misuse the authenticated identity context of users adopting the combined setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This is another unpinned execution of npx soulprint, again in the context of first-time identity verification. Because the workflow claims to handle identity proofing locally and may involve OCR and face-matching, any malicious package release could exfiltrate biometric and document data or tamper with verification outputs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.